Sharkord CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Sharkord CVE published 2026-10-20

CVE-2026-113595

CVE-2026-113595 is a missing authorization vulnerability in Sharkord before version 0.0.26. The vulnerability exists in the others.changeLogo tRPC mutation, allowing any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. This could potentially allow attackers to remove the current logo and replace it with an uploaded image that is published to every connected client.

MEDIUM Sharkord CVE published 2026-10-20

CVE-2026-113594

CVE-2026-113594 is a missing authorization vulnerability in Sharkord before version 0.0.8. The vulnerability allows any authenticated member to change server-wide settings via the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. This could lead to various impacts, including setting a join password, disabling registration, or toggling plugin loading.